CVE-2025-58875: WP Github Gist Stored XSS Vulnerability

CVE-2025-58875 Overview

CVE-2025-58875 is a stored cross-site scripting (XSS) vulnerability in the Sudar Muthu WP Github Gist WordPress plugin. The flaw affects all versions of wp-github-gist up to and including version 0.5. The plugin fails to properly neutralize user input during web page generation, allowing authenticated attackers with low privileges to inject persistent malicious scripts.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Exploitation requires user interaction and low-privileged access, but the injected payload persists in the WordPress database and executes in the browser context of any user who views the affected page.

Critical Impact
Stored XSS payloads execute in authenticated administrator sessions, enabling session hijacking, credential theft, and unauthorized actions across the affected WordPress installation.

Affected Products

Sudar Muthu WP Github Gist plugin for WordPress
All versions from initial release through 0.5
WordPress sites with the wp-github-gist plugin installed and activated

Discovery Timeline

2025-09-05 - CVE-2025-58875 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58875

Vulnerability Analysis

The WP Github Gist plugin embeds GitHub Gist content into WordPress posts and pages. The plugin accepts user-supplied input, such as Gist identifiers or configuration parameters, and renders it into the generated HTML without adequate output encoding or sanitization.

An authenticated contributor or author can inject JavaScript payloads through plugin-controlled fields. When a site visitor or administrator loads the page containing the malicious content, the browser executes the payload in the site's origin. The scope change indicator in the CVSS vector signals that the impact crosses trust boundaries, meaning attacker-controlled script runs in the context of higher-privileged users.

Stored XSS in a WordPress plugin frequently leads to full administrative takeover. Attackers can leverage script execution to create rogue admin accounts, exfiltrate authentication cookies, or pivot to server-side code execution through the WordPress theme and plugin editors.

Root Cause

The root cause is missing or insufficient output encoding when the plugin renders user-supplied Gist parameters into HTML. Input passed through shortcodes or plugin settings is not passed through WordPress sanitization APIs such as esc_html(), esc_attr(), or wp_kses() before being echoed to the page.

Attack Vector

The attack is network-based and requires an authenticated account with permission to create or edit posts containing the plugin's shortcode. The attacker embeds a crafted payload that survives storage and triggers on page rendering. User interaction, such as an administrator viewing the post or preview, is required to trigger execution.

The vulnerability manifests when the plugin outputs stored Gist parameters into the DOM without escaping. Refer to the Patchstack advisory for CVE-2025-58875 for additional technical detail.

Detection Methods for CVE-2025-58875

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror or onload, or javascript: URIs stored within WordPress posts using the wp-github-gist shortcode
New WordPress administrator accounts created without authorized change tickets
Outbound HTTP requests from browser sessions to unfamiliar domains after loading pages containing Gist embeds
Modifications to wp_options, active theme files, or plugin files following administrator page views

Detection Strategies

Scan the wp_posts table for shortcode instances of wp-github-gist and inspect parameters for HTML or JavaScript syntax
Deploy web application firewall rules that flag XSS payload patterns in POST requests to wp-admin/post.php and wp-admin/admin-ajax.php
Monitor WordPress audit logs for post edits by contributor and author roles that introduce shortcodes with unusual attribute values

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to identify inline script violations on pages that render Gist embeds
Alert on privilege escalation events, particularly the creation of users with the administrator role
Track file integrity of plugin, theme, and wp-config.php files to detect post-exploitation tampering

How to Mitigate CVE-2025-58875

Immediate Actions Required

Deactivate and remove the WP Github Gist plugin until an upstream fix is available, as no patched version above 0.5 has been published
Audit existing posts and pages for wp-github-gist shortcodes and remove any containing suspicious attribute values
Rotate WordPress administrator passwords and invalidate active sessions if the plugin has been in use
Restrict content creation permissions to trusted users only while remediation is in progress

Patch Information

No vendor patch is available at the time of publication. The vulnerability affects WP Github Gist through version 0.5, and the plugin has not received an updated release addressing the flaw. Site operators should treat the plugin as unmaintained and plan migration to an alternative Gist embed solution. Consult the Patchstack vulnerability report for the current status.

Workarounds

Replace WP Github Gist with an actively maintained Gist embed plugin or use GitHub's native Gist embed script directly in trusted templates
Apply a virtual patch through a WordPress web application firewall that blocks XSS payloads submitted to plugin shortcode parameters
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

bash

# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate wp-github-gist
wp plugin delete wp-github-gist

# Search post content for the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[wp-github-gist%';"